CVE-2020-17143: 
vulnerability analysis and mitigation

Microsoft Exchange Server Information Disclosure Vulnerability (CVE-2020-17143) was disclosed and patched in December 2020. The vulnerability affects multiple versions of Microsoft Exchange Server including Exchange Server 2013 Cumulative Update 23, Exchange Server 2016 Cumulative Update 17 and 18, and Exchange Server 2019 Cumulative Update 6 and 7 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges with no user interaction (NVD).

This vulnerability could allow an attacker to gain unauthorized access to sensitive information. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, making it relatively accessible to attackers. However, specific details about exploitation methods or instances of the vulnerability being exploited in the wild are not publicly available (NVD).

Microsoft released security updates to address this vulnerability in December 2020. The fix was included in various cumulative updates: Exchange Server 2019 CU6 and CU7, Exchange Server 2016 CU17 and CU18, and Exchange Server 2013 CU23. Organizations are advised to apply these security updates to protect against this vulnerability (Microsoft Support).